Privacy Notice — SheetSieve by Braivex

Effective Date: 02 November 2026 (Braivex Legal v2.1)

1. Data Controller & Operator

SheetSieve is operated by Hemant Sain, trading as Braivex, located at Yog Nagar, 60 Feet Road, Alwar, Rajasthan 301001, India. For all data protection and privacy enquiries, contact hemant@braivex.com.

2. Data Minimisation & Ephemeral Spreadsheet Processing

In accordance with UK/EU GDPR Article 5(1)(c) (Data Minimisation), spreadsheets parsed in the interactive SheetSieve Studio are transformed directly in your browser session. When you invoke the Vertex AI Gemini 2.5 Flash Smart Column Mapper, only the column header names and up to three sample rows are sent to Google Cloud Vertex AI (gen-lang-client-0626367853) under enterprise zero-training terms.

3. Sub-Processors & Hosting

• Google Cloud Platform (Cloud Run & Vertex AI) — Serverless application hosting in Google Cloud Run (europe-west2, London).
• Braivex Accounts (accounts.braivex.com) — Central OIDC authentication across the Braivex portfolio.
• Shopify Billing API (Shopify Admin Invoice) — Merchant of Record for subscription billing and tax compliance.

4. Your Data Subject Rights (DSAR & Erasure)

Under UK/EU GDPR Articles 15–22 and the India Digital Personal Data Protection Act 2023, you have the right to access, rectify, export, or erase your account data and saved import flows at any time by emailing support@braivex.com.

5. Shopify Protected Customer Data Compliance (Level 1 & Level 2)

• Purpose & Data Minimisation: SheetSieve accesses Shopify Customer (name, email, phone, company, tags) and Order (order number, fulfillment tracking) records strictly at the merchant's instruction to match and bulk-update store records from merchant-supplied CSV files. Customer PII is processed ephemerally in-memory and is never persisted to disk, sold, or used for profiling or advertising.
• Encryption in Transit & at Rest: All data in transit is encrypted via HTTPS / TLS 1.3. Ephemeral container memory and configuration stores on Google Cloud Run (europe-west2, London) are encrypted at rest using AES-256.
• Mandatory Shopify Compliance Webhooks: SheetSieve verifies X-Shopify-Hmac-Sha256 signatures using constant-time comparison and responds within 5 seconds to customers/data_request, customers/redact, shop/redact (/api/webhooks/compliance), and app/uninstalled (/api/webhooks/uninstalled).
• Access Control, Logging & Incident Response: Production infrastructure is isolated from development environments via Google Cloud IAM least-privilege controls with multi-factor authentication (MFA), automated secret rotation, and zero customer PII in application logs. Security incidents are triaged within 24 hours via hemant@braivex.com.